CTI · corroborated · 2026-08-12

CaptiveCrunch: Midnight Blizzard Sub-Cluster Weaponizes Hotel Wi-Fi Captive Portals to Attack Corporate Travelers Worldwide

Full story & timeline

MITRE ATT&CK

• T1669 Wi-Fi Networks Initial Access
• T1659 Content Injection Initial Access
• T1557 Adversary-in-the-Middle Credential Access
• T1621 Multi-Factor Authentication Request Generation Credential Access
• T1548 Abuse Elevation Control Mechanism Privilege Escalation
• T1185 Browser Session Hijacking Collection

Indicators

Observables tied to this case, from the curated feed. raw sidecar

• delivery.evidence domain · expired

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: CaptiveCrunch CornFlake Process and ChocoShell CDP Artifacts
id: 67bb4c56-96fc-4828-997d-1f9b671587b4
status: experimental
description: >
    Detects process-level artifacts documented for the CaptiveCrunch
    campaign (Storm-2945 / Midnight Blizzard, active since May 2026):
    the CornFlake Go RAT running as svchost32.exe from a user-writable
    AppData path, and ChocoShell relaunching browsers with a remote
    debugging port to exfiltrate cookies over the Chrome DevTools
    Protocol, bypassing App-Bound Encryption.
references:
    - https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/
    - https://malware.news/t/captivecrunch-midnight-blizzard-weaponizes-hotel-wi-fi-captive-portals-to-steal-microsoft-365-credentials/124711#post_1
author: Tia N. List
date: 2026/08/12
tags:
    - attack.t1669
    - attack.t1659
    - attack.t1557
    - attack.t1621
    - attack.t1548
    - attack.t1185
logsource:
    category: process_creation
    product: windows
detection:
    selection_svchost32:
        Image|endswith: '\svchost32.exe'
        Image|contains: '\AppData\'
    selection_remote_debugging:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
        CommandLine|contains: '--remote-debugging-port'
    condition: 1 of selection_*
falsepositives:
    - Legitimate browser automation (Selenium, Playwright) uses --remote-debugging-port
    - Application support binaries that borrow Windows service names; corroborate with network telemetry
level: high
---
title: CaptiveCrunch ChocoShell and CornFlake C2 Beaconing
id: 4ac775bb-cafe-42e3-8f7f-92d454dbdc11
status: experimental
description: >
    Detects network connections to infrastructure documented for the
    CaptiveCrunch campaign (Storm-2945 / Midnight Blizzard): the
    ChocoShell infostealer C2 address 213.145.86.112 and the CornFlake
    beacon domains ms365-device.com and ms365-live.com used to
    masquerade as Microsoft 365 endpoints.
references:
    - https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/
    - https://malware.news/t/captivecrunch-midnight-blizzard-weaponizes-hotel-wi-fi-captive-portals-to-steal-microsoft-365-credentials/124711#post_1
author: Tia N. List
date: 2026/08/12
tags:
    - attack.t1669
    - attack.t1659
    - attack.t1557
    - attack.t1621
    - attack.t1548
    - attack.t1185
logsource:
    category: network_connection
    product: windows
detection:
    selection_c2_ip:
        DestinationIp: '213.145.86.112'
    selection_c2_domain:
        DestinationHostname|endswith:
            - 'ms365-device.com'
            - 'ms365-live.com'
    condition: 1 of selection_*
falsepositives:
    - None known; the IP and lookalike domains are unique to the campaign and are not legitimate Microsoft infrastructure
level: high

Splunk SPL raw

# captivecrunch-midnight-blizzard-sub-cluster-weaponizes-hotel-wi — Splunk SPL variant (derived from captivecrunch-midnight-blizzard-sub-cluster-weaponizes-hotel-wi.sigma via sigma convert)
# source-sha256: a23b3b55a33febaf7a4d853de4c9b118a98bd0da452eb493e019c7b5fa417af1 v1
(Image="*\\svchost32.exe" Image="*\\AppData\\*") OR (Image IN ("*\\chrome.exe", "*\\msedge.exe", "*\\firefox.exe") CommandLine="*--remote-debugging-port*")

DestinationIp="213.145.86.112" OR DestinationHostname IN ("*ms365-device.com", "*ms365-live.com")

KQL (Sentinel / Defender) raw

# captivecrunch-midnight-blizzard-sub-cluster-weaponizes-hotel-wi — KQL variant (derived from captivecrunch-midnight-blizzard-sub-cluster-weaponizes-hotel-wi.sigma via sigma convert)
# source-sha256: a23b3b55a33febaf7a4d853de4c9b118a98bd0da452eb493e019c7b5fa417af1 v1
(Image endswith "\\svchost32.exe" and Image contains "\\AppData\\") or ((Image endswith "\\chrome.exe" or Image endswith "\\msedge.exe" or Image endswith "\\firefox.exe") and CommandLine contains "--remote-debugging-port")

DestinationIp =~ "213.145.86.112" or (DestinationHostname endswith "ms365-device.com" or DestinationHostname endswith "ms365-live.com")

YARA-X raw

rule CaptiveCrunch_CornFlake_ChocoShell {
    meta:
        author = "Tia N. List"
        date = "2026-08-12"
        status = "experimental"
        description = "CornFlake Go RAT and ChocoShell infostealer from the CaptiveCrunch campaign (Storm-2945 / Midnight Blizzard): fake-update dropper UI text, Cloud Sync Service persistence name (svchost32.exe), and masquerading Microsoft 365 C2 infrastructure. Derived from Microsoft Threat Intelligence case analysis — NOT validated against a live sample."
        reference = "https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/"
        falsepositives = "Windows Update and installer UX commonly display 'Don't turn off your computer' and generic sync services use similar branding; require the PE context plus at least two of the documented strings and corroborate with process/network telemetry"
    strings:
        $update_ui = "Don't turn off your computer" ascii
        $service_name = "Cloud Sync Service" ascii
        $svc_bin = "svchost32" ascii
        $c2_domain1 = "ms365-device.com" ascii nocase
        $c2_domain2 = "ms365-live.com" ascii nocase
        $c2_ip = "213.145.86.112" ascii
    condition:
        uint16(0) == 0x5A4D and 2 of them
}

References

• https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/
• https://malware.news/t/captivecrunch-midnight-blizzard-weaponizes-hotel-wi-fi-captive-portals-to-steal-microsoft-365-credentials/124711#post_1